feat:runscope test

server/internal/services/tokenscope_test.go

@@ -111,3 +111,77 @@ func TestScopedTargetsExcludeOutOfScopeServers(t *testing.T) {
 		t.Errorf("scoped targets = %v, want only a", got)
 	}
 }
+
+// A workflow run is dispatched to whatever ResolveTargetsScoped returns, so
+// the property Critical 1 restores is that a run of a production-targeting
+// workflow, started by a staging token, reaches nothing. Proved over
+// UnionTargets for the same reason as the test above: no database.
+func TestScopedRunOfOutOfScopeWorkflowReachesNothing(t *testing.T) {
+	all := []models.Server{
+		{ServerID: "prod-1", Tags: map[string]string{"env": "prod"}},
+		{ServerID: "prod-2", Tags: map[string]string{"env": "prod"}},
+	}
+
+	scope := map[string]string{"env": "staging"}
+	visible := []models.Server{}
+	for _, s := range all {
+		if ServerInTokenScope(s, scope) {
+			visible = append(visible, s)
+		}
+	}
+
+	// The workflow's own saved targets, both by ID and by tag.
+	got := UnionTargets(visible, []string{"prod-1", "prod-2"}, map[string]string{"env": "prod"})
+	if len(got) != 0 {
+		t.Errorf("staging-scoped run resolved %v, want nothing", got)
+	}
+	// ResolveTargetsScoped turns that empty set into ErrNoTargets, which is
+	// the same answer a workflow targeting no servers at all gives — so the
+	// refusal does not tell the caller that production hosts exist.
+}
+
+// The scheduler passes a nil scope because it acts as the system. That must
+// keep meaning "the whole fleet", never "nothing", or every scheduled workflow
+// would silently stop firing.
+func TestNilScopeIsUnrestrictedNotEmpty(t *testing.T) {
+	all := []models.Server{
+		{ServerID: "prod-1", Tags: map[string]string{"env": "prod"}},
+		{ServerID: "stg-1", Tags: map[string]string{"env": "staging"}},
+	}
+	visible := []models.Server{}
+	for _, s := range all {
+		if ServerInTokenScope(s, nil) {
+			visible = append(visible, s)
+		}
+	}
+	if len(visible) != 2 {
+		t.Errorf("nil scope admitted %d servers, want all %d", len(visible), len(all))
+	}
+}
+
+// FilterVisibleServerIDs is what narrows a run document's ServerRuns and a
+// workflow's target list. The property that matters is that the caller is told
+// something was hidden without being told how much.
+func TestFilterVisibleServerIDsReportsHiddenWithoutCount(t *testing.T) {
+	visible := map[string]bool{"a": true}
+
+	got, hidden := FilterVisibleServerIDs([]string{"a", "b", "c"}, visible, true)
+	if len(got) != 1 || got[0] != "a" {
+		t.Errorf("filtered = %v, want [a]", got)
+	}
+	if !hidden {
+		t.Error("hidden = false with two ids dropped")
+	}
+
+	// Dropping one and dropping ten are indistinguishable: hidden is a bool.
+	_, hiddenOne := FilterVisibleServerIDs([]string{"a", "b"}, visible, true)
+	if hiddenOne != hidden {
+		t.Error("hidden distinguishes how many were dropped")
+	}
+
+	// An unrestricted caller is never told anything was hidden.
+	got, hidden = FilterVisibleServerIDs([]string{"a", "b"}, nil, false)
+	if len(got) != 2 || hidden {
+		t.Errorf("unrestricted filter = %v, %v; want everything and no hidden flag", got, hidden)
+	}
+}